This fixes a format string vulnerabilty.
evdev_log_message() composes a format string consisting of a fixed
prefix (including the rendered device name) and the passed-in format
buffer. This format string is then passed with the arguments to the
actual log handler, which usually and eventually ends up being printf.
If the device name contains a printf-style format directive, these ended
up in the format string and thus get interpreted correctly, e.g. for a
device "Foo%sBar" the log message vs printf invocation ends up being:
evdev_log_message(device, "some message %s", "some argument");
printf("event9 - Foo%sBar: some message %s", "some argument");
This can enable an attacker to execute malicious code with the
privileges of the process using libinput.
To exploit this, an attacker needs to be able to create a kernel device
with a malicious name, e.g. through /dev/uinput or a Bluetooth device.
To fix this, convert any potential format directives in the device name
by duplicating percentages.
Pre-rendering the device to avoid the issue altogether would be nicer
but the current log level hooks do not easily allow for this. The device
name is the only user-controlled part of the format string.
A second potential issue is the sysname of the device which is also
sanitized.
This issue was found by Albin Eldstål-Ahrens and Benjamin Svensson from
Assured AB, and independently by Lukas Lamster.
Fixes#752
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit a423d7d326)
This makes disable-when-typing for the touchpad work properly
on the Lenovo Legion Y740.
Tested on Lenovo Legion Y740-15IRHg.
Signed-off-by: Markus Wall <markuswall@yahoo.se>
Clarify that when forking libinput the public visibility level should be
selected. Otherwise, CI pipelines will fail on merge requests.
Also, update the fork URL.
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
The changes introduced in b5b6f835af to
add support for hold gestures introduced a regression:
The mechanism that was in place to improve the disambiguation between
two finger pinch and scroll during the beginning of the gesture stopped
working and instead a bug warning was printed on the log.
Fix the regression by allowing to go from the scroll state to the pinch
state.
Fix#726
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
This include ci-templates commit 0c312d9c7255f which hopefully fixes our
current headaches with the one non-signed-off commit that somehow
managed to find its way into the repo.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
When a boolean quirk was displayed its real value was ignored and
instead a hardcoded value of 1 was always used.
Get the quirk real value and display it.
Fix#725
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Since cd4f2f32b5 ("fallback: disable mouse scroll wheel while middle
button is pressed") the mouse wheel is inhibited while the mouse wheel
is pressed.
The original intention of this feature was to avoid unintended scroll
while pressing the scroll wheel. However, now that high-resolution
scroll is fully integrated in libinput we can improve this feature and
filter unintended scroll (below half a detent) and allow it when it is
intended (over half a detent).
Remove the "WHEEL_STATE_PRESSED" state from the wheel state machine and
let the general heuristics handle this case.
Also, remove the specific tests for this feature as now it is covered
by the general test cases.
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
The device sends its own scroll events when its trackpoint is moved
while the middle button is pressed.
Because scroll events are not going to be inhibited after a certain
amount of scroll is detected in a follow up commit, remove the quirk.
This reverts 53bd70f4c7 ("quirks: Lenovo Trackpoint Keyboard II")
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
We use check directly to test the various litest bits, so if ifdef out
the litest main() and a few other bits. This results in compiler
warnings that aren't worth fixing - a lot of moving code around for no
real benefit.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
The Wacom 524C device triggers a kernel bug in the InRange and Invert
handling. Every time BTN_TOUCH is set/unset the device also sets/unsets
BTN_TOOL_PEN even when we nominally have the eraser in proximity.
The event sequence effectively looks like this:
# on prox in
BTN_TOOL_RUBBER 1
-- SYN_REPORT ---
# on tip down
BTN_TOOL_PEN 1
BTN_TOUCH 1
-- SYN_REPORT ---
# on tip up
BTN_TOUCH 0
BTN_TOOL_PEN 0
-- SYN_REPORT ---
# on prox out
BTN_TOOL_RUBBER 1
-- SYN_REPORT ---
To work around this, bias our duplicate tool detection code towards the
eraser - if we have an eraser in-prox already and the pen goes
in-prox, ignore it and continue with the eraser. But if we have a pen
in-prox and the eraser goes in-prox as well, force a prox-out for the
pen and put the eraser in-prox.
Recording originally from
https://github.com/linuxwacom/xf86-input-wacom/issues/186Fixes#702
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
This device triggers a kernel bug in the InRange and Invert handling,
every time BTN_TOUCH is set the device also sets BTN_TOOL_PEN even when
we currently have the eraser in proximity.
Recording from https://github.com/linuxwacom/xf86-input-wacom/issues/186
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Depending on how quick the test suite runs we may get a hold end event
here. Let's silently ignore that one since we aren't interested in it.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
The changes made in ca3df8a076 to improve
pinch detection introduced a regression:
When the thumb is used to press the clickpad it is automatically tagged
as thumb and the gesture state machine does not initialize it, leaving
its initial X and Y position set to 0.
When another finger is put on the clickpad, the distance moved by the
thumb is checked and because its initial position is 0 movement is
detected.
Add an additional check to take into account only thumbs that are used
in the gesture.
Fix#708
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
The most common trigger for this is the debouncing timer which is a mere
12ms and is effectively unavoidable, virtually every caller will
trigger those messages at some point.
Let's add a grace period of 20ms below which we don't log this message
to avoid logspam. And in the process, bump the equivalent warning
message up to 20ms as well.
Related #711
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
We already ratelimit the normal notification about event processing
lagging behind but in the case of timers actually expiring late, we'd
pass those messages on. So lots of clicks on a slow-reponse system
resulted in lots of messages triggered by the debounce timers.
Use the same ratelimiting as the event processing warning, 5 messages
per hour which should be a good balance between warning and not spamming
the log.
Fixes#711
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
The EVDEV_UDEV_TAG_JOYSTICK is set when a joystick or gamepad button
is found. However, it can not be used to identify joysticks or
gamepads because there are keyboards that also have it. Even worse,
many joysticks also map KEY_* and thus are tagged as keyboards.
In order to be able to detect joysticks and gamepads and
differentiate them from keyboards, apply the following rules:
1. The device is tagged as joystick but not as tablet
2. It has at least 2 joystick buttons
3. It doesn't have 10 keyboard keys
Fix#701Fix#415Fix#703
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Move the logic to detect joysticks and gamepads to its own function.
Refactor, no functional changes.
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Adds touchpad pressure configuration for Lenovo Yoga 2 Pro in order to avoid random cursor jumps on finger up.
Signed-off-by: Joaquin Gonzalez <joaquin.gonzalez.uy@gmail.com>
Add two helper functions that set/unset BTN_TOUCH together with the
specified axes and switch all tests over.
Devices can override the tip down/up sequence.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
This is a clickpad announcing BTN_RIGHT in different machines, see
issue #674, #689, #629 and MR !701. There are at least 4 machines that
ship with this device that we had to quirk independently, possibly
others so disabling BTN_RIGHT on all of them makes sense.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Follow the name convention used in evdev-wheel.c and rename the handle
event functions from "tp_gesture_[STATE]_handle_event" to
"tp_gesture_handle_event_on_state_[STATE]".
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Most mice with high-resolution support have a mechanism in place to
adjust the wheel to a detent. When scrolling, it is possible to stop
between two detents and this mechanism could generate a small amount of
scroll in the oposite direction.
Track the scroll direction in the wheel state machine and reset it when
the direction changes to avoid this issue.
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Mice with high-resolution support can generate deltas when the finger is
put on the wheel or when the user tries to click the wheel.
To avoid sending involuntary scroll events, add an extra state the the
wheel state machine to accumulate scroll deltas.
While the accumulated scroll is lower than a certain threshold, ignore
them until the threshold is reached.
Since no finish event is sent by the mouse, reset the state machine
after a period of scroll inactivity.
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
In order to be able to add more complex rules in the future, transform
the current wheel handling code into a state machine.
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Before hold gestures where implemented, when a thumb was detected it
was enough to reset the state machine.
However, now it is possible to detect a thumb while a hold gesture is
in course.
Cancel any ongoing gesture when a thumb is detected to avoid dropping
the gesture end event.
See #693
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
